KR20210043069A - System and method for storing security information using a plurality of storages - Google Patents

Abstract

The present invention relates to a security information storage system and a method thereof and, more specifically, to a security information storage system using a plurality of storages and a method thereof, wherein, in a state in which at least one main storage and at least one sub storage are connected, an encrypted security area (hereinafter referred to as "security disc" or "safe") is created in the connected storages, and can be used only within security policies when a sub storage and a main storage are solely connected, and files can be created, modified and deleted in the security disc and security configuration can be implemented only when the plurality of main and sub storages are all connected.

Description

Security information storage system and method using a plurality of storages {System and method for storing security information using a plurality of storages}

The present invention relates to a security information storage system and method, and more particularly, to a security area (hereinafter referred to as "secure disk" or (Referred to as "safe"), and when sub storage and main storage are connected separately, they can be used only within the security policy, and files are created and changed on the secure disk according to the number of connections of the plurality of main and sub storages. And a security information storage system and method using a plurality of storages capable of deleting and performing security settings.

The spread of high-speed Internet, the public, and the grafting of wireless communication technologies have created a cloud computing environment that allows access to the Internet network anytime, anywhere and provide various services.

And as the spread of various computers such as desktop computers, personal computers, notebook computers, tablet computers, smart devices such as smart phones and smart pads has become common, most users store and use important information in computers.

The dissemination of such computers and the construction of a cloud computing environment assist people to facilitate their work, provide pleasure, and provide convenience in various fields.

However, storing and managing important information in such a computer and using a cloud computing environment provides an environment in which one's terminal can be hacked by someone anytime, anywhere, and is stored in the computer by a hacker or others. It provides an environment in which important information of the company can be easily exposed and leaked.

Due to this problem, various security systems are applied to computers. These security systems include a login-type security system that inputs an ID/password when the computer is booted, the entire storage device of the computer, or a partial area of the storage device, such as prior Patent Publication [10-2009-0067649]. A storage device security system with an encryption method that encrypts or encrypts only selected specific files, and allows the use of the partial areas or files only through a specific authentication procedure, and a security storage system that hides and hides specific disk areas, folders, and files, etc. There is this.

The storage device security system has been used in places where a large number of people use a large number of computers, such as PC rooms and corporations, but in recent years, it is expanding to individuals due to the spread of portable computers.

However, most of the storage device security systems are configured so that the encrypted security area can be used only by inputting an ID and password, or a password, as in the prior patent publication, and thus, there is a problem in that security is poor.

That is, in the conventional storage device security system, if only the ID and password or password is exposed, all information of the computer may be leaked.

In addition, in the conventional storage device security system, even if you do not know the ID and password, it is possible to know that there is an encrypted separate area in the storage device, so that an expert by a hacker or the like can induce an attempt to hack the ID and password in a random area. The ID and password could be hacked by such an attempt, and there was a problem in that information could be leaked.

In addition, in the conventional secure storage system that hides specific disk areas, folders, and files, when a user has malicious intent and hides and removes important security information by using a security storage to which a conventional security storage system is applied, a security administrator can use the hidden area. Since it cannot be confirmed, there is a problem that information leakage using a secure storage system may occur. That is, the conventional security information storage system has a problem that can be reversely used by hackers and spies.

Patent Publication No. 10-2009-0067649

Accordingly, an object of the present invention is to create an encrypted secure disk in the connected storage while at least one main storage and at least one sub storage are connected, and when the sub storage and the main storage are connected alone, the security policy Security information storage system and method using a plurality of storages that can be used only in and can create, change, and delete files on the secure disk or perform security settings according to the number of connections of the plurality of main storage and sub storages In providing.

In addition, another object of the present invention is to provide a security information storage system and method using a plurality of storages for backing up data stored in the main storage and the sub storage to the storage of another computer device connected through a network when a preset mirroring condition is satisfied. Is in.

In addition, another object of the present invention is to allow the files stored in the secure disk of the main storage to be exported or shared to the outside through any one or more of e-mail, web hard, and cloud services, but to the agent, which is a dedicated program. Security information using multiple storages that includes the file in the agent so that the file can be used only within the security policy, and attaches the agent to any one of e-mail, web hard, and cloud so that it can be exported or shared outside. To provide a storage system and method.

A security information storage system using a plurality of storages according to the present invention for achieving the above object includes: a main storage; Removable sub storage; And at least one of the main storage and one or more sub-storages as constituent elements, each obtaining the number and storage identification information, and in a state in which the main storage and the sub-storage of the obtained storage identification information are connected to the main storage and the sub-storage. Creates a secure disk, creates and generates a disk security application including an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and sub storage By executing the secured disk application, the properties of the files stored in the secure disk are set differently according to whether the main storage and the sub storage, which are the components, and the number of connection of the sub storage, are set differently, and at least one main storage and at least one And a storage encryption device that controls to change and delete files stored in the secure disk of the main storage and the sub storage when the sub storage is connected.

The number of the main storage is one and the hard disk is configured inside the storage encryption device, and the number of the sub storage is two, and the asynchronous serial bus memory is characterized in that.

The storage encryption device includes: a kernel layer unit that mounts the secure disks of the main storage and the sub storage as drives and processes output of files to the secure disk and input of files from the secure disk; Obtaining storage identification information of the main storage and sub storage, creating a secure disk in the main storage and sub storage while the main storage and two sub storages of the obtained storage identification information are connected, and storing the secure disk in the secure disk An encryption module for encrypting a file to be encrypted, a decryption module for decrypting the encrypted file, and a secure disk generator for generating a disk security application including storage identification information of the main storage and the sub storage; And differently set properties of files stored in the secure disk according to whether the main storage and the sub storage, which are the components, and the number of connections of the sub storage, are differently set by execution of the generated disk security application, and at least one main storage and Controls to change and delete files stored in the secure disk of the main storage and the sub storage when at least one sub storage is connected, and control to change the secure disk setting information of the secure disk when both of the sub storage are connected. It characterized in that it comprises a disk security application unit.

The secure disk generation unit provides a secure disk setting user interface means to a user, receives the main storage selection through the secure disk setting user interface means, and receives the two sub-storages to receive the main storage and the number of sub-storages. And a secure disk setting unit that obtains and stores the storage identification information. A component complete inspection unit that performs a component complete inspection that checks whether the main storage and the sub storage of the storage identification information of one main storage and two sub storages for the storage identification information set through the secure disk setting unit are connected. ; A sub secured disk generator configured to generate a secured disk in a substorage when it is determined that all components are configured through the component complete inspection unit; And if it is determined through the component complete inspection unit that all components are configured, a secure disk is created in the sub storage, and then the sub secure disk generation unit is instructed to create a sub secure disk, and a secure disk of the sub storage is created. Then, an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and a main secure disk generator for generating a disk security application including storage identification information of the main storage and the sub storage. It is characterized by that.

The main security disk generation unit generates a security disk in the sub storage when it is determined that all components are configured through the component complete inspection unit, and then instructs the sub security disk generation unit to create a sub security disk. A disk creation processing unit; And an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, storage identification information of the main storage and sub storage, and an encryption method of the file and activation and deactivation of the secure disk. It characterized in that it comprises a main disk security application unit for generating a disk security application including a security policy including security identification information for.

The main secure disk generation processing unit includes a security data area for storing a file, a digital key and a destruction key, and encryption method information for encrypting the secure disk when it is determined that all components are configured through the component complete inspection unit. A secure disk configuration unit for generating a secure disk including a digital key area including the policy information including; And an encryption unit for generating an encryption module for encrypting a file according to an encryption method of the policy information of the digital key and a decryption module for decrypting the encrypted file, wherein the disk security application unit includes the digital key, It characterized in that the location of the secure disk is found by the digital key, and the secure disk is activated and deactivated.

The sub-secure disc generation unit may include: a sub-secure disc generation processing unit configured to generate a secure disc in a sub-storage and set the secure disc as a read attribute when it is determined that all the constituent elements are configured through the component complete inspection unit; And a decryption module for decrypting a file encrypted and stored in the secure disk of the sub storage, and a sub disk security application that is stored in the sub storage by creating a sub disk security application including storage identification information of the main storage and the sub storage. It characterized in that it comprises a sub-generation unit.

The sub-disk security application is stored in the boot area of the USB memory, which is the sub storage, and is configured to be automatically executed by the computer when the USB memory is inserted into the computer.

The sub-disk security application is stored in an area other than the secure disk of the sub-storage and is configured to be executed when a user's execution request occurs through a computer to which the sub-storage is connected.

The disk security application unit includes: a setting information storage unit including a component identification information storage unit for storing storage identification information of the main storage and sub storage, which are the constituent elements, and a policy information storage unit for storing the policy information; And differently set properties of files stored in the secure disk according to whether the main storage and the sub storage, which are components corresponding to the storage identification information of the setting information storage unit, are connected, and the number of connection of the sub storage, and at least one main storage and Controls to change and delete files stored in the secure disk of the main storage and the sub storage when at least one sub storage is connected, and control to change the secure disk setting information of the secure disk when both of the sub storages are connected And a main secure disk activation control unit having a main secure disk service execution unit.

The main secure disk service execution unit may include a component complete inspection unit that checks whether all components are connected or only partially connected according to the registered storage identification information; An input/output file setting unit configured to set properties for files stored in one or more secure disks among connected main storage and sub storage according to a result of the component complete inspection performed by the component complete inspection unit; An encryption unit for encrypting a file stored in the secured disk and decrypting a file read from the secured disk; And when the security disk application is executed, the main storage and sub storage having the security disk are searched, the security disk is searched in the connected storage, the found security disk is mounted on the drive and activated, and the mounted drive is removed when a deactivation request occurs. It characterized in that it comprises a secure disk activation unit for deactivating the secure disk.

The main secure disk service execution unit, when an event of attaching a file attached to any one of e-mail, web hard, and cloud of a file stored in one of the main storage and sub-storage occurs, through the component complete inspection unit If the main storage and at least one sub-storage are connected, the encrypted file to be attached, a decryption module for decrypting the file, an encryption module for re-encrypting the decrypted file, and a security policy restricting the use of the file are included. After generating the agent, it characterized in that it further comprises a file external export processing unit for attaching the generated agent to any one of e-mail, web hard, and cloud.

The security policy may include at least one of a timestamp policy for allowing the file to be used only for a certain period of time and a policy for limiting the number of times of use for allowing the file to be used only a certain number of times.

The main secure disk service execution unit checks whether a preset mirroring condition is satisfied, and when the mirroring condition is satisfied, backs up files stored in the secure disk of one or more connected storages of the main storage and sub storage to a mirroring system connected through a network. It characterized in that it further comprises a mirroring processing unit to configure the same files as the files stored in the secure disk in the mirroring system.

The mirroring condition is characterized in that it includes a predetermined period, whether the file stored in the secure disk has exceeded a predetermined time from the storage point, the storage of a new file, and an increase in capacity of a predetermined unit of a predetermined capacity.

The disk security application unit includes: a setting information storage unit including a component identification information storage unit for storing storage identification information of the main storage and sub storage, which are the constituent elements, and a policy information storage unit for storing the policy information; And differently set properties of files stored in the secure disk according to whether the main storage and the sub storage, which are components corresponding to the storage identification information of the setting information storage unit, are connected, and the number of connection of the sub storage, and at least one main storage and Controls to change and delete files stored in the secure disk of the main storage and the sub storage when at least one sub storage is connected, and control to change the secure disk setting information of the secure disk when both of the sub storage are connected. It characterized in that it comprises a main secure disk activation control unit having a main secure disk service execution unit.

The disk security application unit may include: a setting information storage unit including a component identification information storage unit for storing storage identification information of the main storage and the sub storage as the component; And the decryption module, and when accessing the main storage, which is a component corresponding to the storage identification information of the setting information storage unit, calls the main secure disk activation control unit, and if the main storage is not connected, it is stored in the secure disk. And a sub secure disk activation control unit including a sub secure disk service execution unit that decodes and executes a file of the read attribute that has been read by the decryption module.

A security information storage system using a plurality of storages according to the present invention for achieving the above object: acquires the number and storage identification information of each of at least one main storage and one or more sub storages as components, and the acquisition An encryption module that creates a secure disk in the main storage and sub storage while the main storage and sub storage of the stored storage identification information are connected, and encrypts a file stored in the secure disk, a decryption module that decrypts the encrypted file, and A secure disk creation process of generating a disk security application including storage identification information of the main storage and sub storage; And differently set properties of files stored in the secure disk according to whether the main storage and the sub storage, which are the components, and the number of connections of the sub storage, are differently set by execution of the generated disk security application, and at least one main storage and And a process of using a secure disk for controlling to change and delete files stored in the secure disk of the main storage and the sub storage when at least one sub storage is connected.

The secured disk creation process includes at least one main storage and one or more sub-storages as constituent elements, acquiring the number and storage identification information, and in a state in which the main storage and the sub-storage of the obtained storage identification information are connected, the main storage A secure disk creation step of creating a secure disk in storage and sub storage; And an application generating step of generating a disk security application including an encryption module for encrypting a file stored in the secure disk, a decryption module for decoding the encrypted file, and storage identification information of the main storage and the sub storage. It is characterized.

In the step of creating the secure disk, a secure disk setting user interface means is provided to the user, the main storage is selected through the secure disk setting user interface means, the two sub storages are selected, and the main storage and the sub storage are A secure disk setting step of acquiring and storing the number and the storage identification information; Component complete inspection to check whether the main storage and sub storage of storage identification information for one main storage and two sub storages for the storage identification information set through the secure disk setting unit are connected. step; A main storage secured disk creation step of instructing the sub secured disk creation unit to create a sub secured disk after creating a secured disk in the substorage when it is determined that all components are configured through the component complete inspection unit; And creating a sub-storage secure disk of generating a secure disk in the sub-storage.

The generating of the main storage secure disk includes: a digital key assignment step of allocating a digital key area for identifying the secure disk area; A digital key generation step of generating a digital key including a key and information for activating the secure disk and storing it in the digital key area; An encryption step of encrypting files in a secure data area other than the digital key area of the secure disk; And an application generating step of generating and storing a main disk security application including the digital key, an encryption module for encrypting a file stored in the secure data area, a decryption module for decrypting the encrypted file, and unique identification information of storages. It characterized in that it includes.

In the step of creating the main storage secured disk, if the substorage is a portable memory that does not have unique storage identification information when the secured disk is created, a sub-storage identification information allocation step of generating unique sub-storage identification information and recording it in the sub-storage is performed. Further comprising, in the application generating step, characterized in that generating a main disk security application including the allocated sub-storage identification information.

The generating of the sub-storage secure disc may include: allocating a digital key area for identifying the secure disc area; A digital key generation step of generating a digital key including a key and information for activating the secure disk and storing it in the digital key area; An encryption step of encrypting files in a secure data area other than the digital key area of the secure disk; And generating a sub-disk security application including the digital key, a decryption module for decrypting the file encrypted and stored in the secure data area, and sub-storage identification information, and storing the application in the sub-storage. It is characterized.

In the sub-storage secured creation step, if the sub-storage is a portable memory that does not have unique storage identification information when the secured disk is created, a sub-storage identification information allocation step of generating unique sub-storage identification information and recording it in the sub-storage is performed. Further comprising, in the application generating step, characterized in that generating a sub-disk security application including the allocated main storage identification information and the sub-storage identification information.

The process of using the secure disk may include an application determination step of determining whether the disk security application is a main disk security application when the disk security application is driven; If the main disk security application, the main storage security disk activation step of activating the security disk of the main storage; A sub storage connection checking step of determining whether at least one sub storage connected when the secure disk was created is connected; An encryption/decryption module driving step of driving an encryption module and a decryption module if the sub-storage connected during the creation of the secure disk is connected; A file property setting step of setting read/write properties for files stored in the secure disks of the main storage and the sub storage; And a file input/output processing step of encrypting and processing files input/output to the secure disk of the main storage and the sub storage.

The process of using the secure disk may include a step of driving a decryption module for driving a decryption module if the sub-storage connected when the secure disk was created in the sub-storage connection checking step is not connected; A file attribute setting step of setting files of the secure disk of the main storage as read attributes; And a file output processing step of decoding and processing a file output from the secure disk of the main storage.

The process of using the secure disk may include a file write monitoring step of checking whether a file input processing request by a file write command is generated during the execution of the file output processing step; And a sub storage insertion request step of displaying a message requesting insertion of the sub storage when the file write command is generated, wherein when the sub storage is inserted, a process after the step of driving the encryption/decryption module is performed. It is done.

The process of using the secure disk may include activating the secure disk of the sub storage if the application driven in the application determination step is a sub disk security application; A main storage connection checking step of determining whether the main storage connected when the secure disk was created is connected;

An encryption/decryption module driving step of driving an encryption module and a decryption module if the main storage connected during the creation of the secure disk is connected; A file property setting step of setting read/write properties for files stored in the secure disks of the main storage and the sub storage; And a file input/output processing step of encrypting and processing files input/output to the secure disk of the main storage and the sub storage.

The process of using the secure disk may include driving a decryption module when it is determined that the main storage connected when the secure disk was created in the main storage connection checking step is not connected; A file attribute setting step of setting read attributes for files stored in the secure disk of the sub storage; And a file processing step of performing a decryption process when a file stored in the secure disk is requested to be opened and processing the file to be read.

In the process of using the secure disk, an encrypted file requested to be attached when a file attachment event to be attached to any one of email, web hard, and cloud for a file stored in the secure disk during file input/output processing in the file input/output processing step occurs. Including, as an executable application program that sets the properties of the file to read/write only by execution, decrypts and encrypts the file, and creates an agent that enables editing of the file, e-mail, web hard, and cloud It characterized in that it further comprises the step of exporting the file attached to any one of the outside.

The step of removing the file to the outside may include a file attachment event monitoring step of monitoring whether a file attachment event for requesting an e-mail file attachment to a file stored in the secure disk occurs during the file input/output processing; A sub-storage connection check step of checking whether a sub-storage connected when the secure disk was created is connected when a file attachment event occurs; A security policy setting step of setting a security policy for a selected file if the sub storage is connected; The file, including the file, the encryption module, the decryption module, and a security policy, is an executable application program that drives the encryption module and the decryption module by execution, and sets read/write properties to the file within the security policy, and the file An agent creation step of creating an agent that enables editing of the agent; And a file attachment step of attaching the generated agent to any one of e-mail, web hard, and cloud.

In the present invention, the secure disk can be created in the main storage and the sub storage only when there is at least one main storage and at least one sub storage directly connected to the storage encryption device, and at least one main storage connected when the secure disk is created. And since it is possible to change and delete files on the secured disk of the storage only when at least one substorage is connected, a third party connects an arbitrary substorage to the storage encryption device to access the files stored on the secured disk of the main storage. Even if copied, it has the effect of restricting use.

In addition, conversely, even if a file in the main storage is leaked by connecting a sub-storage where a secure disk is created according to the present invention, even if the externally knows the security identification information, it has only limited properties, so its use in other storage is restricted This has the effect of increasing security.

In addition, in the present invention, when information, that is, a file must be exported to the outside and used, an agent that includes an encrypted and encrypted file of the file, and allows the use of the file only within a security policy can be created and attached. It has the effect of minimizing the leakage of information while improving work efficiency by leaving a record of file export by transmission and allowing the agent to use the included file only within the security policy.

In addition, the present invention backs up data stored in the secure disk area of the main storage when the storage encryption device satisfies the mirroring condition, so that security information can be safely preserved in case a third party damages the secure disk area of the main storage. Has an effect.

1 is a diagram showing the configuration of a security information storage system using a plurality of storage according to the present invention.
2 is a diagram showing the configuration of a storage encryption device of a security information storage system using a plurality of storages according to the present invention.
3 is a diagram showing a detailed configuration of a main and sub secure disk generation unit of a secure disk generation unit of the storage encryption device according to the present invention.
4 is a diagram showing a detailed configuration of a main secure disk activation control unit of a disk security application unit of a storage encryption device according to the present invention.
5 is a diagram showing a detailed configuration of a sub-secure disk activation control unit of a disk security application unit of the storage encryption device according to the present invention.
6 is a diagram showing the configuration of an agent execution apparatus according to the present invention.
7 is a diagram illustrating a mirroring system of a security information storage system using a plurality of storages according to an embodiment of the present invention.
8 is a flowchart illustrating a method of storing security information using a plurality of storages according to the present invention.
9 is a flowchart illustrating a method of generating a secure disk in a method of storing security information using a plurality of storages according to the present invention.
10 is a flowchart showing a method for checking complete components of a method for creating a secure disk according to the present invention.
11 is a flowchart illustrating a method of creating a main storage secure disk in a method of creating a secure disk according to the present invention.
12 is a flowchart illustrating a method of creating a secured sub-storage disk in a method of creating a secured disk according to the present invention.
13 is a flowchart illustrating a method of setting a secure disk in a method of storing security information using a plurality of storages according to the present invention.
14 is a flowchart illustrating a method of using a secure disk in a method of storing security information using a plurality of storages according to the present invention.
15 is a flowchart illustrating a method of activating a secure disk in a method of storing security information using a plurality of storages according to the present invention.
16 is a flowchart illustrating a method of carrying out files from a secure disk to the outside of a method for storing security information using a plurality of storages according to the present invention.
17 is a flowchart illustrating a method of using a file exported by a method of carrying out a secure disk file to the outside of a method for storing security information using a plurality of storages according to the present invention.

Hereinafter, a configuration and operation of a security information storage system using a plurality of storages according to the present invention will be described with reference to the accompanying drawings, and a method of storing security information in the system will be described.

1 is a diagram showing the configuration of a security information storage system using a plurality of storage according to the present invention.

The security information storage system 1000 using a plurality of storages according to the present invention includes one or more sub storages 100, at least one main storage 200, and a storage encryption device 300.

The main storage 200 is a storage device having a storage space of a predetermined capacity with main storage identification information. The main storage 200 may be a hard disk, a high-speed semiconductor mass storage device (Solid Stage Disk: SSD), a Universal Serial Bus (USB), etc., but the storage encryption device 300 is used. Since it is a storage device, it would be preferable to use a hard disk or an SSD.

The sub-storage 100 is a storage device having a storage space of a certain capacity, and may be a hard disk or SSD having sub-storage identification information, or an asynchronous serial bus (USB) memory that does not have sub-storage identification information. It could be a portable mass storage device. However, the sub-storage 100 is a storage device that acts like a key according to the present invention, and is preferably a removable and portable storage device such as a USB memory.

The storage encryption device 300 has a capacity set for each of the main storage 200 and the sub storage 100 when a request to create a secure disk occurs while at least one of the main storage 200 and at least one sub storage 100 are connected. Create a secure disk with a secure data area for. The capacity of the secure disk may be the total capacity of the main storage or the sub storage, or may be a partial capacity.

The secure disk includes a digital key area and a security data area. The method of configuring and creating the secure disk is Korean Patent Registration 10-1442539 (2014.09.15.) (hereinafter referred to as "prior technology 1") and Registration Patent 10-1476222 (2014.12.18.) (hereinafter referred to as "prior technology 2"). H) Since it has been described in detail in [Storage System and Method with Secure Storage Device], detailed description thereof will be omitted.

In the prior art 1 and the prior art 2, the secure disk is configured to be invisible when it is deactivated. Grana In the present invention, it is possible to map the secure disk to an arbitrary file visible when the secure disk is deactivated and store it in the corresponding storage. In other words, the secure disk is mapped and saved in the A.doc file. That is, a secure disk is created under the name A.doc. By configuring this way, it will be possible to prevent the storage of the secure disk from being leaked without the knowledge of the security administrator. Since the technique of mapping a disk area to the arbitrary file and configuring it is a technique well known to those of ordinary skill in the art, a detailed description thereof will be omitted.

When the secure disk is created in the main storage 200 and the sub storage 100 according to the present invention, when the main storage 200 and the sub storage 100 have unique identification information, the storage encryption device 300 is Unique storage identification information when storage identification information, which is the unique identification information of the storage 200 and the sub storage 100, is acquired and managed, and there is no storage identification information in at least one of the main storage 200 and the sub storage 100 Is created, allocated to the storage, and stored and managed. The generated storage identification information may be stored in a general area of a corresponding storage or a digital key area of a secure disk. If the storage is a USB memory, it may be stored in a boot area, or may be included in a generated disk security application. .

In addition, the storage encryption device 300 may activate or deactivate the secure disk, set a security disk security policy, store a set security policy, and may include at least one of an encryption module and a decryption module, and the set A disk security application that manages changes and deletions of files stored or stored in the security data area of the secure disk according to the security policy is created. The disk security application may be configured to operate in both the main storage mode and the sub storage mode, or may be composed of one application operating only in the main storage mode and two sub disk security applications operating only in the sub storage mode.

When a secure disk is created in the main storage 200 and the sub storage 100 and a disk security application is created, the storage encryption device 300 changes a file stored in the secure disk by the disk security application or In the case of deletion, when the components are complete by performing a component complete test to check whether at least one main storage 200 and at least one sub storage 100 connected when the secure disk was created are connected, Allows you to change or delete files stored on the secure disk.

If the components are not complete and only the main storage 200 is connected, the storage encryption device 300 allows the storage encryption device 300 to be used within a preset security policy. That is, the storage encryption device 300 can create a new file, but manages to enable only reading by setting only read properties for files stored in the secure disk.

The disk security application may be stored in an arbitrary area of the main storage 200 or may be stored in a boot area of the sub storage 100. This is to allow the disk security application to be automatically executed when the main storage 200 and the sub storage 100 are portable storage devices such as USB memory devices when connected to any computer device.

The security policy includes whether to apply security identification information authentication for activating the secure disk of the main storage 200 and the sub storage 100 and security identification information according to the application, and whether to allow export to the outside of the file through e-mail, or outside the file. Includes the timestamp for the file when export is allowed, the policy for limiting use of the number of uses, and the properties of the file (read/write).

The timestamp is set for each folder or file, and stores information about the usage period of the folder and file.

2 is a diagram showing the configuration of a storage encryption device of a security information storage system using a plurality of storages according to the present invention.

Referring to FIG. 2, the storage encryption device 300 includes a secure disk generation unit 400, a disk security application unit 500, and a kernel layer unit 600.

The secure disk generation unit 400 may be configured in the storage encryption device 300 and the disk security application unit 500 may be configured in both the storage encryption device 300 and a general computer device. However, when configured in a computer device, only a disk security application unit including only the sub secure disk activation control unit 530 will be configured. That is, when the sub storage 100 such as a USB memory is connected to an external computer, the sub secure disk activation control unit 530 of the disk security application unit 500 is stored in the sub storage 100 according to the present invention. It will be activated by running the sub-disk security application.

The secured disk generating unit 400 includes a secured disk setting unit 410, a component complete inspection unit 420, a main secured disk generating unit 430, and a sub secured disc generating unit 440.

The secure disk setting unit 410 provides a secure disk creation setting user interface means to the user to create a secure disk, such as the capacity of the secure disk for each of the main storage 200 and the sub storage 100, encryption method, security identification information, etc. And set the security policy.

The component completeness inspection unit 420 performs component completeness inspection to check whether components for configuring the security information storage system according to the present invention are connected. In order to configure the security information storage system according to the present invention, at least one main storage 200 and at least one sub storage 100 must be connected to the storage encryption device 300. The number of the main storage 200 and the sub storage 100 may be configured to be designated in the secure disk setting unit 410.

The component complete inspection unit 420 has one main storage 200 and two sub-storages 100, for example, when one main storage 200 and one sub-storage 100 are connected Wow, it will be determined that the components are complete when both the one main storage 200 and the two sub storages 100 are connected.

The main secured disk generation unit 430 creates a secured disk in the main storage 200 according to the main secured disk setting information set by the secured disk setting unit 410, and encrypts data on the secured disk. In addition, the main secure disk generation unit 430 generates a main disk security application after creating the secure disk. In this case, the generated main disk security application may be configured to be executed by a user, may be configured to be automatically executed, or may be configured to be automatically executed at every booting time.

The sub-secure disc generation unit 440 creates a secure disc in the sub-storage 100 according to the sub-secure disc setting information set by the secure disc setting unit 410, and encrypts data on the secure disc. The sub-secure disc generation unit 440 may also generate a sub-disc security application after the secure disc is generated, and store the sub-storage 100 in one of a boot area, a general data area, and a secure disc.

When stored in the boot area, each time the sub storage 100 is connected to the storage encryption device 300 or any computer device, the sub disk security application will be executed by the connected device.

The disk security application unit 500 includes a main secure disk activation control unit 510 and a sub secure disk activation control unit 530.

The main secure disk activation control unit 510 is driven when the main disk security application is executed to control activation and deactivation of the main storage 200 and the sub storage 100 according to the present invention. , According to whether the sub storage 100 is connected, data stored in the secure data area of the secure disk, that is, properties of files are defined. When a secure disk is created while one main storage 200 and two sub storages 100 are connected, the main secure disk active control unit 510 is It is possible to create a new file by assigning only the read attribute to the files of the secured disk, but it is controlled so that it cannot be changed or deleted, and when one or more sub-storages 100 are connected, the files of the secured disk are By giving read and write properties, files stored in the secure disk can be modified, changed, or deleted, and when two sub storages 100 are connected, file creation, change, and deletion are possible, and security It controls the security disk settings such as policy, security identification information, and security disk capacity to be changed.

As described above, the sub-secure disk activation control unit 530 includes the sub-storage 100 in which the secure disc is created is connected to the storage encryption device 300 or the sub-disk stored in the sub-storage 100 when connected to a general computer. It is configured on the device by the execution of the security application.

The sub secured disk activation control unit 530 controls activation and deactivation of the secured disk of the substorage 100, decrypts a file stored in the secured data area of the secured disk when activated, and controls only reading from the configured device.

The kernel layer unit 600 is configured between the disk security application unit 500, the main storage 200, and the sub storage 100 to perform connection management of storages, and input/output requests generated by the disk security application unit 500 In response to the data, data to be stored in the storage and data input/output processing for input/output of the stored data are performed.

3 is a diagram showing a detailed configuration of a main and sub secure disk generation unit of a secure disk generation unit in the storage encryption device according to the present invention.

As described above, the secure disk generation unit 400 includes a main secure disk generation unit 430 and a sub secure disk generation unit 440.

The main secure disk generation unit 430 includes a main secure disk generation processing unit 431 and a main disk security application generation unit 432.

The main secured disk generation processing unit 431 includes a secured disk configuration unit 4311 for generating a secured disk in the main storage 200 according to the prior art 1 and 2, and an encryption module for encrypting data of the generated secured disk. , And an encryption unit 4312 including a decryption module for decrypting the encrypted data.

The main disk security application generation unit 432 activates and deactivates the secure disk of the main storage 200, and whether or not to authenticate by security identification information for activating and deactivating the secure disk, registering and changing the security identification information, and Secure disk settings such as deletion, whether to allow external export through e-mail, security policy setting when external export is allowed, and whether or not to apply a mirroring system are performed, and security identification information authentication according to the above settings, external file export operation through e-mail, and mirroring Create a main disk security application that performs such operations.

The main disk security application will include a digital key for searching for a secure disk and activating and deactivating the secure disk according to the application of the prior art 1 and the prior art 2 described above. Also, the main disk security application will contain a destruction key to destroy the secure disk. This is applied in the same manner as in the prior art 1 and the prior art 2, so a detailed description thereof will be omitted.

The sub-secure disc generation unit 440 also includes a sub-secure disc generation processing unit 441 and a sub-disc security application generation unit 442.

The sub-secure disc generation processing unit 441 creates a secure disc in the sub-storage 100.

The sub-disk security application generation unit 442 generates a sub-disk security application and stores the generated sub-disk security application in the sub storage 100. The sub-disk security application may include only the decryption module and may have security identification information, and the security disk of the sub-storage 100 after authentication is compared with the security identification information that has been received by receiving security identification information from the user. Activate and deactivate.

4 is a diagram showing a detailed configuration of a main secure disk activation control unit of a disk security application unit of a storage encryption device according to the present invention.

The main secure disk activation control unit 510 is configured by executing the main disk security application and the sub disk security application stored in the main storage 200 connected to the storage encryption device 300, and the main secure disk service execution unit 511 ) And a setting information storage unit 512.

The main secure disk service execution unit 511 includes a secure disk activation unit 5111, a secure disk setting unit 5113, an encryption/decryption unit 5114, a component complete inspection unit 5115, an input/output file setting unit 5116, and a file. An external carry-out processing unit 5117 and a mirroring processing unit 5118 are included.

The secure disk activation unit 5111 receives security identification information as in prior art 1 and prior art 2 when a secure disk activation request of the connected main storage 200 and sub storage 100 is requested, and preset security identification information When matched with, the secure disks of the main storage 200 and the sub storage 100 are activated, and when deactivation is requested, the secure disk is deactivated. In Prior Art 1 and Prior Art 2, activation was to make it visible as a drive, and inactivation was to delete the secured disk from the drive and configure it to appear as if there was no data stored in the secured disk and secured disk in the system capacity information. In the invention, it may be configured to delete only the drive and reflect the used capacity of the secured disk in the capacity information, or it may be configured to delete it from the drive, set the secured disk to a specific file, and make it inaccessible. Of course, the present invention may also be configured as in the prior art 1 and 2, and as an option, one of the above-described multiple activation and deactivation methods may be selectively configured.

The secured disk setting unit 5113 sets options such as registration and change of security identification information for activating/deactivating the secured disk, changing the capacity of the secured disk, setting and changing the data encryption method of the secured disk, and whether or not to allow external files to be exported. And a secure disk setting user interface means such as change, security policy setting and change, and the like, and stores security setting information input through the secure disk setting user interface means in the setting information storage unit 512.

The encryption/decryption unit 5114 encrypts data stored in the secure disks of the main storage 200 and the sub storage 100, and decrypts data read from the secure disk.

The component complete inspection unit 5115 loads the unique identification information of the main storage 200 that is currently connected, loads the unique identification information of the sub storage 100, and is connected when configuring the security information storage system according to the present invention. Comparing the component identification information registered for the main storage 200 and the sub storage 100, performing a component complete test to check whether all the components connected when configuring the security information storage system are connected, Provide the results of the test.

The input/output file setting unit 5116 stores files stored in the secure disk of the main storage 200 and the secure disk of the sub storage 100 according to the result of the component complete inspection performed by the component complete inspection unit 5115. Set properties for.

When the security information storage system was created, when one main storage 200 and two sub-storages 100 were connected, for example, if only the main storage 200 was connected, the input/output file setting unit 5116 , The read attribute is set so that the file stored in the activated secure disk of the main storage 200 can only be read.

And when the main storage 200 and one sub storage 100 are connected, the input/output file setting unit 5116 reads files stored in the secure disk of the main storage 200 and the sub storage 100, Set read and write properties so that they can be written.

In addition, if the main storage 200 and the two sub storages 100 are connected, that is, if the components are complete, the input/output file setting unit 5116 is a file of the secure disk of the main storage 200 and the sub storage 100 The read and write properties are set in the field, and the secure disk setting unit 5113 is set to be driven. That is, only when all of the components are complete, various settings of the secure disk may be set and changed through the secure disk setting unit 5113.

The file external export processing unit 5117 is connected to one of the main storage 200 and the sub storage 100 from the user in a state in which at least one sub storage 100 is connected through the component complete inspection unit 5115. When a file export request for a saved file occurs, an agent program (hereinafter referred to as "agent") that includes the file, encryption/decryption module, and security policy is created and allowed to be exported to the outside. The file can be used only by the execution of the agent, and is managed by the agent program to be restricted and used only within the security policy of the file.

When creating the agent, the file external export processing unit 5117 allocates unique identification information, agent identification information, agent creation date and time, attached destination (e-mail, web hard, and cloud), and attaches. It would be desirable to store and manage the requested user information in the agent external export history storage unit 5124.

When the mirroring condition is satisfied among all data or some files stored in the secure disk of the connected main storage 200 and sub storage 100, the mirroring processing unit 5118 connects the data or files through a local network and a broadband network. A mirroring process is performed that is transmitted to and stored in a mirroring system (2000 in FIG. 6). The mirroring condition may be a predetermined time interval, a new file may be stored, a new file having a new predetermined capacity or more, or a case in which the data on the secure disk increases by a predetermined capacity or more.

The setting information storage unit 512 stores secure disk setting information set by the secure disk setting unit 5113. In particular, the setting information storage unit 512 is a digital key storage unit 5121 that stores a digital key that plays an important role in activating and deactivating the secure disk, encrypting and decrypting the secure disk, and the main connected when configuring the security information system. A component identification information storage unit 5122 for storing unique identification information of the storage 200 and sub storage 100, a policy information storage unit 5123 for storing policy information, and an agent external export history storage unit 5124. Includes.

5 is a diagram showing a detailed configuration of a sub-secure disk activation control unit of a disk security application unit of the storage encryption device according to the present invention.

The sub-secure disk activation control unit 530 is configured by executing the sub-disk security application generated by the sub-disk security application generation unit 442 of the sub-secure disk generation unit 440, and the storage encryption device 300 of the present invention It could be configured by running the sub-disk security application executed after connecting the sub storage to a general computer.

The sub secure disk activation control unit 530 includes a sub secure disk service execution unit 531 and a sub secure disk information storage unit 532.

The sub-secure disk information storage unit 532 includes a digital key storage unit 5321 for storing a digital key, a unique identification information storage unit 5322 for storing unique identification information, and the substorage 100 when connecting to a general computer alone. It includes a policy information storage unit 5323 for storing policy information for processing a file stored on the disk as a read attribute. The sub secured disk information storage unit 532 may be configured in the sub storage 100.

The sub secured disk service execution unit 531 includes a secured disk activation unit 5311, a mount processing unit 5312, and a decryption unit 5313.

The secure disk activation unit 5311 provides a sub-storage activation means, and when security identification information is input through the sub-storage activation means, it performs authentication based on the security identification information, and when performing authentication, the secure disk of the sub-storage 100 is In order to activate, a mount request signal is output to the mount processing unit 5312.

In addition, the secure disk activation unit 5311 determines whether it is connected to the storage encryption device 300, and when it is determined that it is connected to the storage encryption device 300, transmits a main disk security application drive request signal to the storage encryption device 300. It will be transmitted to the main secure disk activation control unit 510 to be driven.

The mount processing unit 5312 mounts the secure disk of the sub storage 100 as a drive when a mount request signal is received from the secure disk activation unit 5311.

The decryption unit 5313 decrypts the encrypted and stored file when an open command for the file stored in the secure disk of the sub storage 100 is issued.

6 is a diagram showing the configuration of an agent execution device according to the present invention, and shows the configuration of an agent execution device configured in a computer on which an agent downloaded from at least one of mail, web hard, and cloud is executed.

The agent execution apparatus 700 according to the present invention includes an agent control unit 710 and an agent storage unit 720.

The agent storage unit 720 includes an export file storage unit 721 that stores an external export file included in the agent, and a policy information storage unit 722 that sets a file policy for an external export file.

The agent control unit 710 decrypts and outputs a file encrypted and stored in the export file storage unit 721, or encrypts and stores a changed file and a newly stored file, and an encryption unit 711 and the export file storage unit ( Including a policy application information collection unit 712 that collects policy application information for applying a file policy for a file stored in 721), the overall operation of the file exported to the outside of the present invention is controlled. The policy application information may be time information counted by a timer of a computer in which the agent execution device is configured, and the number of times of use stored in the policy information storage unit 720.

7 is a diagram illustrating a mirroring system of a security information storage system using a plurality of storages according to an embodiment of the present invention.

The storage encryption device 300 of the security information storage system 1000 of the present invention is a mirroring system 2000 set in advance when a mirroring condition is satisfied, and all files stored in the secure disk of the main storage 200 are newly created. A mirroring service is performed in which a file or a changed file is transmitted, stored in the mirroring system 2000, and backed up. The mirroring condition may be a certain period, may be a change of more than a certain capacity of the secure disk, may exceed a certain time per file, a new file may be created, or a file may be changed. will be.

As described above, by backing up the data of the secured disk to the mirroring system 2000, the data of the secured disk can be easily restored when the main storage 200 connected to the storage encryption device 300 is damaged or stolen. Even if the main storage is stolen, since the secure disk is encrypted by a digital key and an arbitrary encryption method, data stored in the secure disk of the main storage 200 cannot be used.

In the above description, the configuration of the security information storage system according to the present invention has been described. Hereinafter, a method of storing security information will be described with reference to FIG. 8.

8 is a flowchart illustrating a method of storing security information using a plurality of storages according to the present invention.

Referring to FIG. 8, the method of storing security information using a plurality of storages according to the present invention includes a process of creating a secure disk (S111) and a process of using a secure disk (S113).

Hereinafter, a process of creating a secure disk will be described in detail with reference to FIGS. 9 to 12.

9 is a flowchart illustrating a method of generating a secure disk in a method of storing security information using a plurality of storages according to the present invention.

First, the secure disk generation unit 400 of the storage encryption device 300 provides a user interface means for creating and setting a secure disk through the secure disk setting unit 410 (S211), and a user interface means for creating and setting the secure disk. When a request to create a secure disk is generated through (S213), the secure disk creation setting information input through the secure disk creation setting means is stored (S215). The secure disk creation setting information may be security identification information of the secure disk, a secure disk encryption method, a main storage designation, the number of sub-storages, a start sector of the secure disk for each storage, and a capacity of the secure disk.

When the secured disk creation setting information is stored, the secured disk generating unit 400 checks whether the components for configuring the secured information storage system are completed through the component complete inspection unit 420 (S217). Whether the components are complete may be checked by whether or not all of the main storage 200 and the sub storage 100 of the number set in the secure disk creation setting are connected to the storage encryption device 300.

When the components are complete, the secure disk generation unit 400 of the storage encryption device 300 generates a secure disk in the main storage 200 according to the secure disk generation setting information through the main secure disk generation unit 430 ( S219).

When the secure disk of the main storage 200 is created, the secure disk generation unit 400 creates a secure disk in the sub storage 100 according to the secure disk generation setting information through the sub secure disk generation unit 440 ( S221).

FIG. 10 is a flowchart illustrating a component complete inspection method of the method for creating a secure disk according to the present invention, and is a detailed flowchart illustrating the component complete inspection method of S217 of FIG. 9 and S611 of FIG. 12 to be described later.

First, the secure disk generation unit 400 checks whether a secure disk creation event occurs (S311). As described above, the secure disk creation event may occur when a secure disk creation request is made, or may occur when the secure disk is reset.

When a secure disk creation event occurs, the secure disk generation unit 400 checks whether the number of main storage 200 and the sub storage 100 set in FIG. 8 are connected through the component complete monitoring unit 420 ( S313), it is determined whether the set storages are normally connected (S315).

If the set storages are not normally connected as a result of the inspection, the secured disk creation unit 400 displays a storage connection request message for a set number of requests to correctly connect at least one or more of the set number of main storage and sub storage (S317). , It is determined whether the storages are normally connected based on the storage identification information of the main and sub storages, which are components registered in advance.

If the setting storages are normally connected, the secure disk generation unit 400 will perform the following process.

In addition, if the storages set for a certain number of times or for a certain period of time are not normally connected, the secured disk generation unit 400 may be configured to end the process of creating the secured disk.

11 is a flowchart illustrating a method of creating a main storage secure disk in a method of creating a secure disk according to the present invention.

Referring to FIG. 11, the main secure disk generation unit 430 generates a unique encryption key and a destruction key (S411 and S413).

When the encryption key and the destruction key are generated, the main secure disk generation unit 430 allocates the encryption key and the destruction key to the digital key of the secure disk (S415), and after generating the digital key (S417), the digital key area The digital key is stored in (S419).

When the digital key is stored in the digital key area, the main secure disk generating unit 430 encrypts the secure data area excluding the digital key area of the secure disc by the set encryption method (S421).

Since the description of the unique encryption key, the destruction key, the digital key and the digital key area is described in detail in the prior art 1 and the prior art 2 of the applicant of the present application, it will be briefly described in the description of the present invention.

When the secure data area is encrypted, the secure disk generation unit 430 encrypts the digital key, the destruction key, and the unique identification information of all the main storage 200 and the sub-storage 100 among the setting information for creating a secure disk, and the encryption method. A disk security application including a module and a decryption module is created (S423).

When the disk security application is generated, the secure disk generation unit 430 stores the disk security application (S425). The disk security application may be stored in an area other than the secure disk of the main storage 200 or in any one of the other main storage 200 and the connected sub storage 100, but in a state connected to the storage encryption device 300 It will work normally.

In addition, as in the prior art 1 and 2 of the applicant of the present application, a key application for activating the secure disk including a digital key and a destruction key, an encryption module and a decryption module for the encryption method, and secure disk creation setting information Both disk security applications including unique identification information of all the main storage 200 and sub storage 100 are created, and the main security disk activation control unit 510 activates the security disk by driving the key application. , It may be configured to run the disk security application on the activated secure disk to perform a component complete inspection and a security information storage operation using a plurality of storages.

12 is a flowchart illustrating a method of generating a secure sub-storage disk in the method of generating a secure disc according to the present invention, and is a flowchart illustrating a method of generating a secure sub-storage disk in S219 of FIG. 9 in detail.

In general, the sub storage 100 will be a portable memory such as a USB memory. In the case of the portable memory, the sub-secure disk generation unit 440 does not have unique device identification information, and thus generates unique identification information for the sub-storage 100 in order to manage the portable memory as the sub-storage 100, The generated unique identification information (or "sub storage identification information") is recorded in the sub storage 100 (S511).

When the sub-storage identification information is recorded in the sub-storage 100, the sub-secure disk generation unit 440 stores the sub-storage identification information, which is a component of the security information system managed by the main secure disk active control unit 510. It is stored in the storage area of the main storage 200 (S513).

The sub-secure disc generation unit 440 generates a unique encryption key and a destruction key in the same manner as when the main secure disc is generated (S514 and S515).

When the encryption key and the destruction key are generated, the sub-secure disk generation unit 440 allocates a digital key area (S517), generates a digital key including the encryption key and the destruction key (S519), and It is stored in the key area (S521).

When the digital key is stored, the sub-secure disc generation unit 440 generates a sub-disc security application including a digital key and a destruction key, and a decryption module including an encryption key (S523).

When the sub-disk security application is generated, the sub-security disk generation unit 440 stores the generated sub-disk security application in the sub storage 100 (S525).

13 is a flowchart illustrating a method of setting a secure disk in a method of storing security information using a plurality of storages according to the present invention, and is a flow chart performed by the main secure disk activation control unit 510 of the disk security application unit 500.

Referring to FIG. 13, the main secure disk activation control unit 510 performs a component complete inspection through the component complete inspection unit 5115 of the main secure disk service execution unit 511 (S611).

If it is determined that all of the components are normally connected in the component perfection test, the main secure disk service execution unit 511 provides a secure disk setting user interface means to the user (S613).

After the provision of the secure disk setting user interface means, the main secure disk service execution unit 511 checks whether a request to store the secure disk settings is generated (S615).

When a request to store the secured disk settings is generated, the main secured disk service execution unit 511 updates the existing secured disk setting information by reflecting the secured disk setting information input through the secured disk setting user interface means (S617).

14 is a flowchart illustrating a method of using a secure disk in a method of storing security information using a plurality of storages according to the present invention, and is a flow chart performed by the disk security application unit 500.

When the disk security application is driven (S711), the secure disk application unit 500 activated by the disk security application determines whether the driven disk security application is a main disk security application (main storage mode) or a sub disk security application (sub storage). Mode) is determined (S713, S715).

If the driven disk security application is the main disk security application, the disk security application unit 500 drives the main security disk activation control unit 510, and the main security disk activation control unit 510 activates the security disk of the main storage 200. It should be done (S714).

When the secure disk is activated, the main secure disk activation control unit 510 checks whether the sub storage 100 is connected (S717).

If the sub storage 100 is not connected, the main secure disk activation control unit 510 drives the decryption module (S719), and then sets the properties of the files stored in the secure disk of the main storage 200 as read properties. (S721).

When the file attribute of the files stored in the secure disk is set as the read attribute, the main secure disk activation control unit 510 checks whether an open command for an arbitrary file is generated (S723). File open may occur when a file is created or a file is read, but since the sub-storage 100 registered as a pre-constituent element serving as a key according to the present invention is not connected, it will only occur when a file is read. This may be because files stored in the secure disk of the main storage 200 can be read only with read attributes.

When a file open occurs, the main secure disk activation control unit 510 opens the file with the read attribute (S725).

When the file is opened, the main secure disk activation control unit 510 checks whether a file writing request is generated (S727).

When a file write command is issued, the main secure disk activation control unit 510 displays a message requesting connection of the sub storage 100 corresponding to the sub storage identification information registered as a component (S729).

After the display, the main secure disk activation control unit 510 checks whether the sub storage is connected (S730).

If the sub-storage 100 is not connected, the main secure disk activation control unit 510 checks whether a secure disk release event occurs (S731), informs that the file cannot be written if no secure disk release event occurs, and reads We will continue to display it as an attribute.

In addition, when the secure disk release event occurs, the main secure disk activation control unit 510 will deactivate the secure disk (S732).

On the other hand, when it is determined that the disk security application is a sub disk security application and the sub storage 100 of the registered component is connected, the main secure disk activation control unit 510 activates the secure disk of the sub storage 100 (S733). ), both the encryption module and the decryption module are driven (S734), and files stored in the secure disks of the main storage 200 and the sub storage 100 are set as read/write properties (S735).

After setting the properties of the files of the visible disk, the main secure disk activation control unit 510 reads a file for commands such as open, close, and save among the files of the secure disk of the main storage 200 and the sub storage 100. And write processing, and encrypting and decrypting read and write-processed files (S737). In addition, at this time, when a command for copying and moving files on the secured disk is issued, the main secured disk activation control unit 510 will allow the copying and moving of the files.

The main secure disk activation control unit 510 checks whether a secure disk release event occurs during file input/output processing such as reading, writing, copying, and moving files as described above (S739).

When the secure disk release event occurs, the main secure disk activation control unit 510 will deactivate the secure disks of the main storage 200 and the sub storage 100.

Herein, a case where even the secure disk of the sub storage 100 is activated has been described, but the secure disk of the sub storage 100 may not be activated or may be configured to be selectively activated.

In addition, when the disk security application is driven in the sub storage 100 (S715), the disk security application unit 500 drives the sub security disk activation control unit 530 so that the security disk of the sub storage 100 is activated. (S743).

When the secure disk of the sub storage is activated, the sub secure disk activation control unit 530 checks whether the main storage 200 of the pre-registered component is connected (S745).

When the main storage 200 is connected, the sub-secure disk activation control unit 530 drives the encryption module and the decryption module (S747). When it is determined that the main storage 200 is connected, the sub-secure disk activation control unit 530 may be configured to activate the secure disk of the main storage 200, or to run the main disk security application. The main storage 200 and the sub storage 100 are connected by the main secure disk activation control unit 510 by requesting and driving the main secure disk activation control unit 510 by driving the main disk security application. It may be possible to perform the same control operation as when.

The sub-secure disk activation control unit 530 sets read/write properties to files stored in the secure disk of the sub-storage 100 after driving the encryption module and the decryption module (S749), and then the sub-storage 100 A file read and write process for commands such as open, close, and save among the files of the secure disk of and encrypt and decrypt a file for performing a read and write process of the file is performed (S750).

If the main storage 200 is not connected (S745), the sub-secure disk activation control unit 530 drives the decryption module (S755), and sets read properties for files stored in the secure disk of the sub-storage 100 Then (S757), a decryption process is performed on the opened file (S758).

15 is a flowchart illustrating a method of activating a secure disk in a method of storing security information using a plurality of storages according to the present invention.

Since the method of activating the secure disk itself can be applied in the same manner as the prior art 1 and the prior art 2 previously applied to the present applicant, it will be briefly described.

The main secure disk activation control unit 510 or the sub secure disk activation control unit 530 requests input of security identification information (S811).

After the request for input of the security identification information, the main secure disk activation control unit 510 checks whether the security identification information is input (S813), and when the security identification information is input, compares the security identification information with the security identification information of the security disk setting information registered in advance. Thus, it is determined whether authentication is successful according to whether or not they match (S815).

If the authentication of the security identification information is successful, the digital key stored in the digital key area of the secure disk is compared with the digital key stored in the digital key storage unit 5121 of the setting information storage unit 512, and Key authentication is performed, and digital key authentication is performed (S817).

The main secure disk activation control unit 510 or the sub secure disk activation control unit 530 determines whether or not the digital key authentication is successful (S819), and if successful, allocates a drive to the secure disk through the kernel layer unit 600. Then, it is mounted on the explorer and activated (S821).

16 is a flowchart illustrating a method of carrying out files from a secure disk to the outside of a method for storing security information using a plurality of storages according to the present invention.

In the present invention, only files that can be read only through the sub storage 100 registered in advance may be taken to the outside so that the files stored in the secure disk of the main storage 200 are not leaked to the outside.

However, when a specific person in charge needs to change the contents of a file from outside, it may be very inconvenient because the file stored in the sub-storage 100 cannot be changed and the file must be newly created.

In order to improve this point, if the file needs to be changed from outside, we propose a method that can be exported to the outside via e-mail with a record so that both can be read and written. Exporting files from the secure disk through any one or more of e-mail, web hard and crowd is performed only in the storage encryption device 300, processed only by the main secure disk active control unit 510, and the sub secure disk active control unit 530 It would be desirable to be configured such that it is impossible to carry out the export process through.

Referring to FIG. 16, when the secure disk of the main storage 200 is activated by the main secure disk activation control unit 510 (S911), the external file export processing unit 5117 checks whether a file attachment event occurs (S913). ). The file attachment event may occur when an attempt is made to attach a file stored in the secure disk to any one of mail, web hard, and cloud as it is meant to be, or may be generated by a command to create an external secure file agent.

When the event occurs, the file external carry-out processing unit 5117 performs the component complete inspection of FIG. 9 described above, and when the component is complete (S915), requests to select a file to be attached (S917).

After requesting the selection of the file to be attached, the file external export processing unit 5117 monitors whether a file is selected (S919), and when the file is selected, provides a policy setting user interface means to the user to request a policy setting (S921). .

After the request for the policy setting, the file external export processing unit 5117 checks whether a policy setting completion command is input (S923), encrypts the file to be attached when a policy setting completion command is input, encrypts the file and the file, and An agent including a decryptable encryption module/decryption module and policy information is generated (S925). It is preferable that the agent includes security identification information set by the user.

The agent can be an executable file, and the file containing the included file according to the security identification information set by the user is decrypted and displayed by the decryption module, and can be encrypted and saved again by the included encryption module after modification. It could be an application that controls it.

When the external export security file agent is generated, the external export security file agent 5117 attaches the external export security file agent to any one of mail, web hard, and cloud (S927).

17 is a flowchart illustrating a method of using a file exported by a method of carrying out a secure disk file to the outside of a method for storing security information using a plurality of storages according to the present invention.

Referring to FIG. 17, when an external security file agent transmitted to at least one of mail, web hard, and cloud is downloaded and executed (S1011), the computer on which the agent is executed (hereinafter referred to as "agent execution device") ( The agent control unit 710 of 700) restores the encrypted file through the encryption unit 711 and stores it in the export file storage unit 721 of the agent storage unit 720 of the agent execution device (S1013).

When the file is restored, the agent control unit 710 collects file policy application information through the policy application information collection unit 712 (S1015). The file policy application information may be the current time and the number of times of use. The time may be obtained from a timer counted by the agent execution device 700 itself, and the number of times of use may be obtained from the policy information storage unit 722 of the agent storage unit 720.

After collecting the file policy application information, the agent control unit 710 checks whether the restored file is opened (S1017). The file open request may be generated by other processors such as a word processor of the agent execution device 700.

When the file open is requested, the agent control unit 710 determines whether the file policy application information satisfies the file policy set in the policy information storage unit 722 (S1019).

As a result of the determination, if the file policy application information does not satisfy the set file policy, the restored file is deleted and the agent is deleted from the upper operating system (OS) (S1021).

On the other hand, if the set file policy is satisfied, the agent control unit 710 decrypts the file through the encryption unit 711 (S1023), sets the read/write property to the file (S1025), Make it open. At this time, it may be configured to prevent copying to another computer or other storage device by the processor.

When the file is opened, the agent control unit 710 checks whether an encryption request event occurs (S1027).

The encryption request event may occur when an encryption request occurs through an agent user interface means or when the processor closes the file.

When the encryption request event occurs, the agent control unit 710 updates the file policy application information of the policy information storage unit 722 (S1031). For example, increase the number of times the file is used by 1.

Meanwhile, it is common knowledge in the art that the present invention is not limited to the above-described typical preferred embodiments, but can be implemented in various ways without departing from the gist of the present invention. Those who have the will be able to understand it easily. If the implementation by such improvement, change, substitution or addition falls within the scope of the following appended claims, the technical idea should also be regarded as belonging to the present invention.

100: sub storage
200: main storage
300: storage encryption device
400: secure disk creation unit
410: secure disk setting unit
420: component complete inspection unit
430: main secure disk creation unit
440: sub-secure disk creation unit
411: secure disk setting unit
412: storage connection monitoring unit
413: main secure disk creation processing unit
414: main disk security application generation unit
430: main secure disk creation unit
431: main secure disk creation processing unit
432: main disk security application generation unit
440: sub-secure disk creation unit
441: Sub-secure disk creation processing unit
442: Sub-disk security application generation unit
500: disk security application unit
510: main secure disk active control unit
511: main secure disk service execution unit
512: setting information storage unit
530: sub secure disk active control unit
531: sub secure disk service execution unit
532: sub-secure disk information storage unit
600: kernel layer
700: agent launcher
1000: security information storage system
2000: mirroring system

Claims (10)

Main storage;
Removable sub storage; And
At least one of the main storage and one or more sub-storages as constituent elements to obtain each number and storage identification information, and secure the main storage and sub-storage while the main storage and sub-storage of the obtained storage identification information are connected Creates a disk, and creates a disk security application including an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and the sub storage, and the generated By executing the disk security application, the attributes of files stored in the secure disk are set differently according to whether the main storage and the sub storage, which are the components, and the number of connection of the sub storage, are differently set, and at least one main storage and at least one or more Including a storage encryption device that controls to change and delete files stored in the secure disk of the main storage and the sub storage when the sub storage is connected,
The storage encryption device,
A kernel layer unit that mounts the secure disks of the main storage and the sub storage as drives and processes file output to the secure disk and input of files from the secure disk;
Obtaining storage identification information of the main storage and sub storage, creating a secure disk in the main storage and sub storage while the main storage and two sub storages of the obtained storage identification information are connected, and storing the secure disk in the secure disk An encryption module for encrypting a file to be encrypted, a decryption module for decrypting the encrypted file, and a secure disk generator for generating a disk security application including storage identification information of the main storage and the sub storage; And
By executing the created disk security application, the properties of files stored in the secure disk are set differently according to whether the main storage and the sub storage, which are the components, and the number of connection of the sub storage, are set differently, and at least one or more main storage and at least Controls to change and delete files stored in the main storage and the secure disk of the sub storage when one or more sub storages are connected, and control to change the secure disk setting information of the secure disk when both of the sub storages are connected. Security information storage system using a plurality of storage, characterized in that it comprises a disk security application unit.
The method of claim 1,
The secure disk generation unit,
A secure disk setting user interface means is provided to the user, the main storage is selected through the secure disk setting user interface means, and the two sub-storages are selected, and the number of the main storage and the sub-storage and the storage identification information are provided. Secure disk setting unit for obtaining and storing;
A component complete inspection unit that performs a component complete inspection that checks whether the main storage and the sub storage of the storage identification information of one main storage and two sub storages for the storage identification information set through the secure disk setting unit are connected. ;
A sub secured disk generator configured to generate a secured disk in a substorage when it is determined that all components are configured through the component complete inspection unit; And
If it is determined through the component complete inspection unit that all components are configured, a secure disk is created in the sub storage, and then the sub secure disk generation unit is instructed to create a sub secure disk, and after the secure disk of the sub storage is created An encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and a main secure disk generator for generating a disk security application including storage identification information of the main storage and the sub storage. Security information storage system using a plurality of storage features.
The method of claim 2,
The main secure disk generation unit,
A main secure disk creation processing unit for generating a secure disk in a sub storage and instructing the sub secure disk creation unit to create a sub secure disk when it is determined that all components are configured through the component complete inspection unit; And
An encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, storage identification information of the main storage and sub storage, and encryption method of the file and activation and deactivation of the secure disk. A security information storage system using a plurality of storages, comprising: a main disk security application unit that generates a disk security application including a security policy including security identification information.
The method of claim 3,
The main secure disk generation processing unit,
If it is determined that all the components are configured through the component complete inspection unit, a digital key area including policy information including information on a security data area for storing a file and information on an encryption method for encrypting a digital, a destruction key, and a secure disk Secure disk configuration unit for generating a secure disk including a; And
An encryption unit for generating an encryption module for encrypting a file according to an encryption method of the policy information of the digital key and a decryption module for decrypting the encrypted file,
The disk security application unit,
The security information storage system using a plurality of storages comprising the digital key, and finding a location of the secure disk by the digital key and activating and deactivating the secure disk.
The method of claim 2,
The sub secured disk generation unit,
A sub-secure disc creation processing unit that creates a secure disc in a sub storage and sets the secure disc as a read attribute when it is determined that all the constituent elements are configured through the component complete inspection unit; And
A sub-disk security application unit stored in the sub-storage by creating a decryption module for decrypting a file encrypted and stored in the secure disk of the sub-storage and a sub-disk security application including storage identification information of the main storage and sub-storage Including a generating unit,
The security information storage system using a plurality of storages, wherein the sub-disk security application is stored in an area other than the secure disk of the sub-storage and is configured to be executed when a user's execution request occurs through a computer to which the sub-storage is connected.
The method of claim 1,
The disk security application unit,
A setting information storage unit including a component identification information storage unit for storing storage identification information of the main storage and sub storage as the component, and a policy information storage unit for storing the policy information; And
According to whether the main storage and the sub storage, which are components corresponding to the storage identification information of the setting information storage unit, are connected and the number of access of the sub storage, the properties of the files stored in the secure disk are differently set, and at least one main storage and at least When one or more sub-storages are connected, files stored in the main storage and the sub-storage can be changed and deleted, and when both of the sub-storages are connected, the secure disk setting information of the secure disk can be changed. A security information storage system using a plurality of storages, comprising: a main secure disk active control unit having a secure disk service execution unit.
The method of claim 6,
The main security disk service execution unit,
A component complete inspection unit that checks whether all components are connected or only part of the components are connected according to the registered storage identification information;
An input/output file setting unit configured to set properties for files stored in one or more secure disks among connected main storage and sub storage according to a result of the component complete inspection performed by the component complete inspection unit;
An encryption unit for encrypting a file stored in the secured disk and decrypting a file read from the secured disk;
When the security disk application is executed, the main storage and the sub storage having the security disk are searched, the security disk is searched in the connected storage, the found security disk is mounted on the drive to activate it, and the mounted drive is removed when a deactivation request occurs. A security information storage system using a plurality of storages, comprising: a secure disk activation unit for deactivating the secure disk.
The method of claim 7,
The main security disk service execution unit,
The main storage and at least one sub-storage through the component complete inspection unit when a file attachment event to be attached to any one of e-mail, web hard, and cloud of a file stored in one of the main storage and sub-storage occurs. When is connected, an agent including the encrypted file to be attached, a decryption module for decrypting the file, an encryption module for re-encrypting the decrypted file, and a security policy restricting the use of the file is generated, and then the Further comprising a file external export processing unit for attaching the generated agent to any one of email, web hard, and cloud,
The security policy includes at least one of a timestamp policy for allowing the file to be used only for a certain period of time and a policy for limiting the number of times of use for allowing the file to be used only a certain number of times. Information storage system.
The method according to claim 7 or 8,
The main security disk service execution unit,
It checks whether a preset mirroring condition is satisfied, and when the mirroring condition is satisfied, the files stored in the secure disk of at least one of the main storage and the sub storage are backed up to a mirroring system connected through a network, and the files stored in the secure disk are A security information storage system using a plurality of storages, further comprising a mirroring processing unit configured to configure the same files in the mirroring system.
At least one main storage and one or more sub-storages as constituents, each of the number and storage identification information is obtained, and the main storage and the sub-storage of the obtained storage identification information are connected to the main storage and the sub-storage. And generating a secure disk application including an encryption module for encrypting a file stored in the secure disk, a decryption module for decrypting the encrypted file, and storage identification information of the main storage and the sub storage. ; And
By executing the created disk security application, the properties of files stored in the secure disk are set differently according to whether the main storage and the sub storage, which are the components, and the number of connection of the sub storage, are set differently, and at least one or more main storage and at least And a process of using a secure disk for controlling to change and delete files stored in the secure disk of the main storage and the sub storage when one or more sub storages are connected.

Images